CVE-2021-32096: CSRF
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLECOMMANDSTRING parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32096?
CVE-2021-32096 has a high severity rating due to its potential to allow remote code execution through CSRF attacks.
How do I fix CVE-2021-32096?
To fix CVE-2021-32096, update the NSA Emissary software to the latest version provided by the vendor.
What impact does CVE-2021-32096 have on my system?
CVE-2021-32096 can allow attackers to execute arbitrary Ruby code on the affected system, leading to potential data compromise.
Is the CVE-2021-32096 vulnerability present in earlier versions of Emissary?
CVE-2021-32096 specifically affects version 5.9.0 of NSA Emissary, and earlier versions may not be impacted.
Can CVE-2021-32096 be exploited without authentication?
Yes, CVE-2021-32096 can be exploited via CSRF attacks, which do not require authentication to execute the malicious payload.